Live· 7 threats on fire this week· last check 2026-10-28 10:47 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

SeverityThreatCategorySourcesFirst publicSocialAffects you

Thursday, Oct 22

critical9.2ExploitedBroccoli2ShellHTTP2ShellNode2ShellBrotli: crafted compressed stream overflows buffer, enables remote code execution

brotli >= 1.0.3, < 1.0.10; >= 1.1.0, < 1.1.1; >= 1.2.0, < 1.2.1 · fix 1.0.10, 1.1.1, 1.2.1 · npm, pypi

PackageIEPK+2

2026-10-21 23:58 UTC

by InfraStack analyst

17 talkingAffects you?

Sunday, Oct 25

high⚡ Early warningTailwormUnpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet

Tailscale <= 1.104.2

InfrastructureI

2026-10-25 00:00 UTC

by InfraStack analyst

5 talkingAffects you?

Tuesday, Oct 27

critical⚡ Early warningExploitedGMO Onamae.com Desktop Cloud (FX trading VDI) breached: stored broker logins used for unauthorized trades, $50M extortion

CMP-202610-gmo-onamae-com-desktop-cloud-fx-trading-vdi-breached-stored-

VendorI

2026-10-27 01:30 UTC

by InfraStack analyst

2 talkingAffects you?

high⚡ Early warningExploitedbonto.io wallet extensionsFake Phantom, Jupiter and Bitget wallet extensions on Firefox Add-ons steal recovery phrases and private keys and drain funds (bonto.io)

CMP-202610-fake-phantom-jupiter-and-bitget-wallet-extensions-on-firefox

PackageI

2026-10-27 00:00 UTC

by InfraStack analyst

1 talkingAffects you?

high⚡ Early warningExploitedGhostActionGhostAction uses stolen GitHub tokens to plant credential-stealing workflows and a fake-font VS Code stealer in thousands of repos

GitHub Actions repos pushed to with stolen tokens

PackageI

2026-10-27 00:00 UTC

by InfraStack analyst

1 talkingAffects you?

high⚡ Early warningExploitedMagecart skimmer planted in Convertr's self-hosted Plausible analytics script steals card data on Brazilian checkout pages

CMP-202610-magecart-skimmer-planted-in-convertr-s-self-hosted-plausible

VendorI

2026-10-27 20:57 UTC

by InfraStack analyst

–Affects you?

high⚡ Early warningExploitedCameraSwarmDahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses

Dahua IP cameras devices with Easy4IP P2P enabled and weak passwords or firmware vulnerable to CVE-2021-33044/33045

InfrastructureI

2026-10-27 06:34 UTC

by InfraStack analyst

–Affects you?

← Saturday, Aug 8On fire · last 7 daysMonday, Aug 10 →

Live· 7 threats on fire this week· last check 2026-10-28 10:47 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

SeverityThreatCategorySourcesFirst publicSocialAffects you

Thursday, Oct 22

critical9.2ExploitedBroccoli2ShellHTTP2ShellNode2ShellBrotli: crafted compressed stream overflows buffer, enables remote code execution

brotli >= 1.0.3, < 1.0.10; >= 1.1.0, < 1.1.1; >= 1.2.0, < 1.2.1 · fix 1.0.10, 1.1.1, 1.2.1 · npm, pypi

PackageIEPK+2

2026-10-21 23:58 UTC

by InfraStack analyst

17 talkingAffects you?

Sunday, Oct 25

high⚡ Early warningTailwormUnpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet

Tailscale <= 1.104.2

InfrastructureI

2026-10-25 00:00 UTC

by InfraStack analyst

5 talkingAffects you?

Tuesday, Oct 27

critical⚡ Early warningExploitedGMO Onamae.com Desktop Cloud (FX trading VDI) breached: stored broker logins used for unauthorized trades, $50M extortion

CMP-202610-gmo-onamae-com-desktop-cloud-fx-trading-vdi-breached-stored-

VendorI

2026-10-27 01:30 UTC

by InfraStack analyst

2 talkingAffects you?

high⚡ Early warningExploitedbonto.io wallet extensionsFake Phantom, Jupiter and Bitget wallet extensions on Firefox Add-ons steal recovery phrases and private keys and drain funds (bonto.io)

CMP-202610-fake-phantom-jupiter-and-bitget-wallet-extensions-on-firefox

PackageI

2026-10-27 00:00 UTC

by InfraStack analyst

1 talkingAffects you?

high⚡ Early warningExploitedGhostActionGhostAction uses stolen GitHub tokens to plant credential-stealing workflows and a fake-font VS Code stealer in thousands of repos

GitHub Actions repos pushed to with stolen tokens

PackageI

2026-10-27 00:00 UTC

by InfraStack analyst

1 talkingAffects you?

high⚡ Early warningExploitedMagecart skimmer planted in Convertr's self-hosted Plausible analytics script steals card data on Brazilian checkout pages

CMP-202610-magecart-skimmer-planted-in-convertr-s-self-hosted-plausible

VendorI

2026-10-27 20:57 UTC

by InfraStack analyst

–Affects you?

high⚡ Early warningExploitedCameraSwarmDahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses

Dahua IP cameras devices with Easy4IP P2P enabled and weak passwords or firmware vulnerable to CVE-2021-33044/33045

InfrastructureI

2026-10-27 06:34 UTC

by InfraStack analyst

–Affects you?

← Saturday, Aug 8On fire · last 7 daysMonday, Aug 10 →